Server Services Missing After Reboot

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

Server services are deleted when:

• Rules Installer 1.10-1.14 is installed.
• Agent is installed on the application server hosting the Console.
• App Control Server is recently installed or upgraded.
• Application server is rebooted.

Environment

• App Control Server: All Supported Versions
• App Control Agent: All Supported Versions
• App Control Rules Installer: 1.10 -1.14
• Windows Server: All Supported Versions

Cause

There was an issue introduced in the Rules Installer v1.10 (EPCB-15460) that caused the Agent's Tamper Protection to prevent a clean uninstall of the App Control Server, leaving behind a "Delete" registry flag. Subsequently, the OS will delete the services after reboot which causes the App Control Server failure.

Resolution

If App Control Services Still Exist:

1. Install the latest Rules Installer.
2. Start > run > regedit > OK
3. Navigate to:

   HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ParityServer\DeleteFlag
   HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ParityReporter\DeleteFlag

4. If the Registry Value DeleteFlag exists, delete it.

 

If App Control Services Already Deleted:

1. Use an administrative command prompt and attempt to re-register the services:

   "C:\Program Files (x86)\Bit9\Parity Server\parityserver.exe" /register /dsn "C:\Program Files (x86)\Bit9\Parity Server\shepherd.dsn"
   "C:\Program Files (x86)\Bit9\Parity Server\Reporter\ParityReporter.exe" /install > "C:\Temp\ReporterInstall.log"

2. If the issue persists, or the install fails for some other reason, a Server uninstall and reinstall will be required.
3. After reinstalling, follow the steps above to verify the DeleteFlag does not exist.